All packages
RuoYi vulnerabilities
4 known CVE vulnerabilities in RuoYi, translated and rated.
- CVE-2025-70986High
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
- CVE-2026-38812Critical
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
- CVE-2025-70985Critical
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside their scope.
- CVE-2026-37216Medium
Ruoyi version 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.